Division by zero in XFontBrowserWidget() of MagickCore/widget.c

[wuruoyu]

Prerequisites

• [√] I have written a descriptive issue title
• [√] I have verified that I am using the latest version of ImageMagick
• [√] I have searched open and closed issues to ensure it has not already been reported

Description

Similar to #3333, a division-by-zero exception can happen in function XFontBrowserWidget() at line 5735 when windows->widget.font_info->ascent = 0 and windows->widget.font_info->descent = 0.
Below is the code that the division-by-zero exception can happen.

ImageMagick/MagickCore/widget.c

Line 5735 in ce7b0f2

visible_fonts=scroll_info.height/(height+(height >> 3));

height is defined in the code below:

ImageMagick/MagickCore/widget.c

Line 5606 in ce7b0f2

height=(unsigned int) (font_info->ascent+font_info->descent);

windows->widget.font_info->ascent and windows->widget.font_info->descent are controller by the user since XFontBrowserWidget() is an API function, and there is no sanity check in between.

Thank you in advance! Let me know if you have any questions.

[urban-warrior]

Thanks for the problem report. We can reproduce it and will have a patch to fix it in the GIT main branch @ https://github.com/ImageMagick/ImageMagick later today. The patch will be available in the beta releases of ImageMagick @ https://imagemagick.org/download/beta/ by sometime tomorrow.